Add website API docs, SSL api-hosts, and git-only deploy workflow.

Serve public storefront docs at /docs/website, expose api.{domain} hosts for API SSL sync, and require push-then-pull deploys instead of rsync.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/main.ts

@@ -1,12 +1,21 @@
 import { NestFactory } from '@nestjs/core';
-import { ValidationPipe } from '@nestjs/common';
+import { RequestMethod, ValidationPipe } from '@nestjs/common';
+import { NestExpressApplication } from '@nestjs/platform-express';
 import { AppModule } from './app.module';
 import { BigIntSerializerInterceptor } from './common/interceptors/bigint-serializer.interceptor';
+import { resolveWebsiteDocsRoot } from './website-docs/website-docs.paths';
 
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
+  const app = await NestFactory.create<NestExpressApplication>(AppModule);
+
+  // Public storefront docs — no /api/v1 prefix, no auth
+  app.setGlobalPrefix('api/v1', {
+    exclude: [
+      { path: 'docs/website', method: RequestMethod.GET },
+      { path: 'docs/website/:fileName', method: RequestMethod.GET },
+    ],
+  });
 
-  app.setGlobalPrefix('api/v1');
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
@@ -20,6 +29,9 @@ async function bootstrap() {
   const port = process.env.PORT ?? 3000;
   await app.listen(port);
   console.log(`API running on http://localhost:${port}/api/v1`);
+  console.log(
+    `Website API docs: http://localhost:${port}/docs/website (root=${resolveWebsiteDocsRoot()})`,
+  );
 }
 
 bootstrap();